Search code examples
elasticsearchkibana

Kibana KQL Visualisation Filter - Exclude one value of list field

I have a elastic index with an "origin" field. This field can have either one or two strings/keywords in a list/array format like this:

"origin": [
  "live"
],

or

"origin": [
  "live",
  "upload"
],

In Kibana I want to create a visualization that splits me the chart in

  • only "live"
  • only "upload" or
  • both

Kibana Screenshot

But if I write a filter command like

origin.keyword : "live"

it obviously it true if the list contains only "live" or both like ["live", "upload"].

How do I have to write this KQL filter to only list documents where "origin" only contains the value "live" in the list?

Thanks!

Solution

  • You can use the "filter" aggregation for that.

    enter image description here

    Will give you graphs like this: enter image description here

    If you need the precise use case describe in your comment

    enter image description here

    Filters a written in kql, so don't hesitate to read the doc to construct your own cases https://www.elastic.co/guide/en/kibana/7.9/kuery-query.html